The present invention relates generally to industrial control systems, and in particular relates to an industrial control system having a battery backed volatile solid-state memory, the battery preventing loss of data during momentary power interruptions.
Industrial controllers are special purpose computers used for the control of industrial processes and the like. While executing a stored program, they read inputs from the controlled process and, according to the logic of a contained control program, provide outputs to the controlled process.
Industrial controllers differ from regular computers both in that they provide xe2x80x9creal-timexe2x80x9d control (i.e., control in which control outputs are produced predictably and rapidly in response to given control inputs) and in that they provide for extremely reliable operation. In this latter regard, the volatile memory used by the industrial controller is often backed up with a battery so that data needed for the control program is not lost during momentary power outages. Volatile memory is that which requires power to maintain its stored data.
Such xe2x80x9cbattery backedxe2x80x9d memory, using a combination of static random access memory (SRAM) and a long life battery such as a lithium cell, is well known. In current control applications, synchronous dynamic random access memory (SDRAM) may be preferred to SRAM because of its higher density, faster speed, and lower cost. Unfortunately, the amount of power needed for SDRAM can be thirty or more times greater than that needed for conventional SRAM devices. The voltage requirements of SDRAM require that the lithium cell voltage be boosted with a DC-to-DC converter, introducing additional power losses of about 25 percent. High speed SRAM is one alternative, but high-speed SRAM still draws about ten times as much current as the older SRAM devices, and does not have the density or low cost of SDRAM.
Battery-backed volatile memory devices have been installed in control systems to reduce the likelihood that data integrity will be lost from volatile memory during instances of power loss. However, it should be appreciated that the battery voltage may decrease to a critical voltage level, at which point cells within the volatile memory may begin to be corrupted. As the backup voltage dips further below the critical level, additional memory is likely to be lost. If the backup voltage reaches the critical level (and below) as the result of cold temperatures or a temporary load on the battery, the low critical voltage may only be temporary. Accordingly, when the power loss is corrected, it is impossible to determine with certainty whether the volatile memory is valid simply by checking the battery voltage at the time.
One approach to this problem is to write a small sample of known data to a small number of cells to verify that these cells have maintained their integrity during the period of battery backup as an indication that the integrity of the entire memory has been maintained. This method, however, is not wholly reliable due to the large number of available cells, on the order of millions, and potentially small number cells that could become corrupted, especially when operating at or slightly below the critical voltage.
As an alternative, cyclic redundancy codes (CRC), or xe2x80x9cparity bitsxe2x80x9d may be attached to memory data, and used to determine, for example, whether the data has been corrupted after periods of battery backup. Unfortunately, memory devices that contain extra bits for parity are becoming more difficult to obtain commercially, and in some cases are becoming obsolete altogether.
What is therefore needed is a more reliable and cost-effective method and apparatus for determining whether a battery-backed volatile memory has been corrupted in a control system that has experienced a power loss.
The present invention provides automatic determination of whether the battery backup voltage level has been sufficient to ensure data integrity in volatile memory during an entire period of line power loss. By checking the history of this voltage level, a microprocessor may determine upon restoration of power whether data stored in volatile memory has been corrupted.
Specifically, the present invention provides a battery backed memory system having a first line receiving a source of line voltage. A volatile solid state memory reliably stores data when operated above a critical voltage level. A second line receiving a source of battery voltage provides backup voltage to the volatile memory during a loss of line voltage. A voltage sensor provides a signal indicating whether the backup voltage is at or below the critical voltage level. A microprocessor communicating with the volatile solid state memory and the voltage sensor, executes a program to determine, based on the signal from the voltage sensor, whether the backup voltage was at or below the critical voltage level at any time during the loss of line voltage.
Thus it is an object of the invention to enable the automatic detection of a reduction in power that jeopardizes data integrity in volatile memory without the need for parity memory devices or complex memory testing schemes.
The system may further include nonvolatile memory communicating with the microprocessor, such that the executed program may be held in the nonvolatile memory.
Thus it is another object of the invention to allow storage of a program in nonvolatile memory that enables the microprocessor determine whether data integrity was maintained in a volatile memory.
The voltage sensor may include a supervisory circuit that compares voltage from the second line to an internal reference to indicate whether the measured voltage is at or below the critical voltage level.
Thus it is another object of the invention to use a simple commercially available device to measure voltage on the volatile memory and produce a corresponding signal.
The voltage sensor may include a latch that receives the signal from the supervisory circuit.
Thus it is another object of the invention to store a signal indicating loss of battery power even after power from the line or from the battery has recovered.
The memory system may include a switch that is controlled by the latch output to provide a high impedance path to the microprocessor.
Thus it is another object of the invention to provide an input to the microprocessor that does not promote excess current flow when the microprocessor is unpowered.
The foregoing objects and advantages may not apply to all embodiments of the inventions and are not intended to define the scope of the invention, for which purpose claims are provided. In the following description, reference is made to the accompanying drawings, which form a part hereof, and in which there is shown by way of illustration, a preferred embodiment of the invention. Such embodiment also does not define the scope of the invention and reference must be made therefore to the claims for this purpose.